The vulnerability permits an attacker to inject malicious JavaScript that is stored within the WordPress database by the WPoperation Elementor Addons plugin. When a victim retrieves any page that renders content provided by this plugin, the script runs in the victim’s browser, potentially stealing session cookies, hijacking the victim’s session, defacing the site, or executing further malicious payloads. This problem reflects the classic CWE‑79 weakness of improper input neutralization.

WordPress installations running the WPoperation Elementor Addons plugin version 1.1.9 or any earlier release are affected.

The CVSS score of 6.5 indicates moderate severity. EPSS is reported as less than 1%, suggesting a low probability of exploitation at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves an authenticated administrator or content editor who can input or edit content that the plugin subsequently renders. Exploitation requires that the attacker has write access to plugin-managed content or settings; once injected, the malicious script executes automatically for any site visitor.